Key distillation from Gaussian states by Gaussian operations 
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We study the secrecy properties of Gaussian states under Gaussian operations. Although such op- 
erations are useless for quantum distillation, we prove that it is possible to distill a secret key secure 
against any attack from sufficiently entangled Gaussian states with non-positive partial transposi- 
tion. Moreover, all such states allow for key distillation, when Eve is assumed to perform finite-size 
coherent attacks before the reconciliation process. 
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Quantum Information Theory (QIT) analyzes the pos- 
sibilities offered by quantum states for information en- 
coding and transmission. New processes such as tele- 
portation 0] , more powerful algorithms 0] or completely 
secure data transmission Q become possible by exploit- 
ing quantum effects. Most of the QIT applications use 
entanglement as resource. It is therefore one of the most 
important tasks of QIT to determine if a given state is 
entangled, and if yes, whether its entanglement is "use- 
ful" for information processing. Distillable states 0, 
posses such useful entaglement: using several copies of 
them and local operations and classical communication 
(LOCC), one can create a smaller number of maximally 
entangled states, which can be used for variety of quan- 
tum information tasks. Given a state, its distillable en- 
tanglement, Erj, measures the amount of pure-state en- 
tanglement that can be extracted from it. Particularly 
important for cryptography is another measure of entan- 
glement Kr>: it specifies the number of secret bits that 
can be extracted from a quantum state using LOCC. Ob- 
viously, Kd > Ed, since a secret key can always be ex- 
tracted from distilled maximally entangled states, using, 
for instance, the Ekert protocol [6j. Entangled states 
which cannot be distilled, i.e. for which Ed = 0, ex- 
ist and are termed "bound entangled" ||. Although it 
was unclear whether these states could contain useful en- 
tanglement, it has been recently shown that there exist 
bound entangled states for which Kd > Ed = 00]. 

All of the above results were originally considered for 
finite dimensional systems. More recently, many of these 
concepts have been translated to the infinite dimensional 
case In these systems, a key role is played by the 
set of Gaussian states and Gaussian operations. First 
of all, it naturally appears in experiments. In fact, non- 
Gaussian operations turn out to be very challenging from 
an experimental point of view. Moreover, the theoretical 
analysis of Gaussian states and operations is also simpli- 
fied since all their properties can be expressed in terms 
of finite-dimensional matrices. 

To analyze the limitations and possibilities offered by 
the Gaussian scenario is a relevant issue. The teleporta- 



tion of coherent states of light have been experimentally 
demonstrated . Quantum cryptography has also been 
successfully translated into the Gaussian regime. Gottes- 
man and Preskill proposed to use squeezed states and ho- 
modyne measurements in a "prepare & measure" scheme 
Actually, no squeezing is required, since coherent 
states are already sufficient for a secure key distribution 
with Gaussian operations |l2l . The experimental im- 
plementation of a coherent-state protocol has been re- 
cently realized in [lij ]. From a more fundamental point 
of view, it is interesting to know which information tasks 
can be achieved in the Gaussian regime. It is known that 
all Gaussian states have positive Wigner function, i.e. 
there is a local variable model reproducing all the (sym- 
metrically ordered) correlations for Gaussian states. De- 
spite the existence of this local description, these states 
and operations are useful for teleporting quantum states, 
or for secure information transmission, applications that 
are impossible in a classical scenario. 

An important negative result in this context was ob- 
tained in Refs. 0,0] : quantum distillation by Gaussian 
operations is impossible. That is, although it is known 
that all Gaussian states with non-positive partial trans- 
position (NPPT) are distillable [lTj , any distillation pro- 
tocol must include a non-Gaussian operation. This can 
be rephrased saying that all entangled mixed states are 
bound entangled in the Gaussian scenario. In this sce- 
nario, it is natural to define the corresponding Gaussian 
versions of entanglement measures, that specify the en- 
tanglement properties of these states under Gaussian Lo- 
cal Operations and Classical Communication (GLOCC). 
For example, GEd defines the Gaussian Distillable En- 
tanglement. The results of 0,0] imply that GEd = 0. 
However, these states may still be useful, since perhaps 
secret bits can be extracted from them using GLOCC. 

In a similar way as for distillable entanglement, for any 
entangled state one can denote by GKd the amount of 
secret bits that can extracted by GLOCC. This quantity 
refers to the distribution of a secret key, and in princi- 
ple is independent of entanglement distillability. Thus, 
secret bits {GKd) appear as a resource (measure) es- 
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pecially suitable for the analysis of entangled Gaussian 
states under Gaussian operations: while GEn = for all 
states, there are states with positive GK D [IlLll3| . 

In this work we analyze the secrecy properties of Gaus- 
sian states under Gaussian operations [lg. We consider 
a protocol where Alice and Bob measure their shared 
entangled state at the single-copy level and process the 
obtained classical results . This type of protocols can 
easily be translated to prepare & measure schemes. First, 
we study the security of our protocol when Eve applies an 
incoherent attack, that is she individually measures her 
state before any key extraction process is started. Under 
these conditions, all NPPT states turn out to be secure. 
The same conclusion holds when Eve applies a coherent 
attack on a finite number of symbols. All these cases 
would correspond to a situation where Eve's quantum 
memory has a finite coherence time. Then, we consider 
more powerful attacks and show that our security proof 
ceases to work for some NPPT states. Finally, using the 

recent results of Ref. jj^J, w e demonstrate the security of where A > and c x > c p > 0. The positivity condition 



of canonical coordinates is kept unchanged. Denote by 
6 the matrix equal to the identity for the position coor- 
dinates and minus the identity for the momenta. Par- 
tial transposition means that jab — ► i'ab = ^aIabQa- 
Therefore, the state p has positive partial transposition 
(PPT) when Jab defines a positive operator, that is 
i'ab — iJn+m- The PPT criterion provides a necessary 
and sufficient condition for separability for lxl [ilj and 
1 x N Gaussian states [12], while it is only a necessary 
condition for the rest of systems j^. As said above, the 
non-positivity of the partial transposition is a necessary 
and sufficient condition for distillability |l7j . 

Two known results will play an important role in what 
follows. First, any NPPT Gaussian state of n + m modes 
can be mapped by GLOCC into an NPPT lxl Gaussian 
and symmetric state 0], whose CM, see Eq. (0, is 
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sufficiently entangled Gaussian states against any attack. 

We consider quantum systems of n canonical degrees 
of freedom, often called modes, Ti. = L 2 (5ft ra ). The com- 
mutation relations for the canonical coordinates R = 
(X 1 ,P 1 ,... 1 X n ,P n ) = (Rx...,R 2n ) read [R a ,R b ] = 
i(J n )ab-, where a, b = 1, . . . , 2n and 
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1 > X(c x — Cp) while the entanglement 



(NPPT) condition gives 

A 2 + c x c p - 1 < X(c x + Cp). 
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And second, given an n-mode Gaussian state p\ with 
CM 71 , it is always possible to construct a 2n mode pur e 
Gaussian state ^12) such that tr 2 ( I 1 !' i2)(^E r i2 1 ) = Pi 
The global CM 712, see Eq. (|3J), has ja = 7i and 



7b = #7i0 



The characteristic function, xp(x), of a state p is defined 
as Xp( x ) = tr(/»W(a;)), where W(x) = exp(— ix T R) are 
the so-called Weyl operators. Gaussian states are those 
states such that Xp is a Gaussian function, 
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Xp( x ) — exp(ix T d — -x T 'yx). 
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where d is a 2n real vector, called displacement vector 
(DV), and 7 is a In x 2n symmetric real matrix, known 
as covariance matrix (CM). The positivity condition of p 
implies that 7 — i J n > 0. All the information about d and 
7 is contained in the first and second moments ti(pRi) 
and tr(pRiRj). 

In what follows we consider two parties, Alice and Bob, 
that share a state p in a composite systems of n + m 
modes. The global CM is 
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where ja (ib) is the CM for the n-mode (m-mode) Gaus- 
sian state of system A (B). The entanglement properties 
of p are completely specified by its CM. 

The effect of partial transposition at the level of CMs 
can be understood from the fact that this map is equiva- 
lent to time-reversal. After partial transposition on, say, 
A, the sign of Alice's momenta is changed while the rest 



where {Afc} defines the symplectic spectrum of 71 and S 
is the symplectic matrix such that S^'jiS is diagonal. 

Having collected all these facts, let us describe how 
Alice and Bob can distill a key from a distillable n x m 
Gaussian state using only Gaussian operations. Since all 
the NPPT Gaussian states can be mapped into symmet- 
ric and entangled states of two modes by GLOCC, we 
restrict our analysis to this type of states. In equivalent 
terms, one can think that the first step in the key dis- 
tillation protocol is the GLOCC transformation of 01 
that transforms any NPPT state into an entangled state 
of this family. Then, both parties measure the X quadra- 
ture, where Xa and Xb denote the measured operator 
and xa and Xb the obtained outcome. After communica- 
tion, they only accept those cases where \xa\ = \%b \ — xq 
[2^|. Each party associates the logical bit (1) to a pos- 
itive (negative) result with the probability p(i,j), with 
i,j = 0,1. This process transforms the quantum state 
into a list of correlated classical bits between Alice and 
Bob. Their error probability, that is the probability that 
their symbols do not coincide, is given by 
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In order to establish a key, Alice and Bob will now 
apply the advantage distillation protocol introduced by 
Maurer [25j]. Alice generates the random bit b. Then, 
she chooses N items from her list of symbols, bA — 
(pAii i>A2, ■ ■ ■ i ^an), an d sends to Bob the vector b such 
that bAi + bi — b mod 2, Vi = 1, . . . ,N, together with 
the list of chosen symbols. Bob computes bsi + bi for his 
corresponding symbols, and if all the results are equal, 
bsi + bi = b', Mi, the bit is accepted. If not, the sym- 
bols are discarded and the process is repeated for another 
vector. The new error probability is (see also [HI Ell) 
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that tends to an equality for N — > oo. 

What is the information that Eve can obtain? As 
usual, all the environment, all the degrees of freedom 
outside Alice and Bob's systems should be accessible to 
her. This means that the global state including Eve is 
pure, \Vabe), and such that tr E (\^ abe}^ abe\) = Pab 
[28j. Denote by |e±±) Eve's states when Alice and Bob 
have projected onto | ± in) . For the case of individual 
attacks, it was shown in 26] that Eve's error in the esti- 
mation of the final bit b is bounded from below by a term 

proportional to | (e_i i_ |e )\ N ■ Therefore, Alice and Bob 

can establish a key if (see [26j for more details) 
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More precisely, if this condition is fulfilled, there is al- 
ways a finite N such that the new list of symbols can be 
distilled into a secret key using one-way protocols |29j . 

From Eq. ©, one can compute the global pure state 
including Eve. Note that taking the Gaussian purifica- 
tion does not imply any loss of generality on Eve's indi- 
vidual attack [23. After projecting on | ± xq), Eve has 
a Gaussian state of two modes, with the CM and DV for 
the states \e±±) given by 
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while 7 = 7 ++ and d = — <i++. Now, the overlap 

between these two states is given by 



l(e++|e— )| 2 = exp 



4(A 2 + X(c x - c p ) - c x c p - l)x\ 
X + c x 



(11) 

Substituting Eqs. JSJ and i|ll|) in 10 one can check, af- 
ter some algebra, that this condition is equivalent to the 
entanglement condition of J^}. That is, all the distill- 
ablc (NPPT) Gaussian states allow a secure key distribu- 
tion under individual attacks using Gaussian operations. 
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FIG. 1: Security analysis of symmetric lxl Gaussian states 
when c x = c p = c. All physical states are above the solid 
line. The dashed line defines the entanglement limit, that 
coincides with the security bound against incoherent attacks. 
States below the dotted line are secure against any attack. 



Moreover, the limits for NPPT entanglement and key dis- 
tillation also coincide if Eve measures in a coherent way a 
finite number Ne <C iV of states before the reconciliation 
process [3J|. Interestingly, these limits hold for any Xq, 
and measurements of arbitrary resolution |2 1| . 

One may wonder what happens when Eve is no longer 
restricted to individual attacks. Indeed, a more powerful 
Eve could wait until the end of the advantage distillation 
protocol and measure in a coherent way all her N sym- 
bols jUl- One can see that the corresponding security 
condition is similar to Eq. JHJ, but replacing Eve's states 
overlap by its square. This new inequality is violated by 
some NPPT states (see figure Note that this only 
implies that the analyzed protocol is not good for these 
states in this more general scenario. 

Nevertheless, using the recent techniques of Ref. |2cj . 
we can find states for which the presented protocol allows 
to extract common bits secure against any attack. After 
a successful X measurement on the state (@J, Alice, Bob 
and Eve share an effective state 
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Then, it has been shown in Ref. 20] that the amount of 
secret bits, R, that Alice and Bob can extract from their 
known quantum state |l9l ] by means of protocols using 
one-way communication is 



R > I(x A : x B ) 



SipfB 2 ) 



(13) 



where / is the mutual information between their measure- 
ment outputs and S(p A X g) the von Neumann entropy of 
their reduced state. In this case, this condition turns out 
to be dependent on xq. Thus, for any state, one has to 
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FIG. 2: Schematic representation of quantum and classical 
key distillation techniques from quantum states. In this work, 
Alice and Bob only perform Gaussian operations. 



look for a value of xo such that R > 0. Although we 
were not able to solve this problem analytically, it can 
be attacked using numerical methods. For example, the 
security curve for those states such that c x = c p (see Eq. 
©) is shown in figure ^ 

One can envisage different ways of improving the pre- 
vious security analysis, e.g. finding better measurements 
for Alice and Bob or new ways of processing their mea- 
surement outcomes. A more interesting possibility con- 
sists of allowing the honest parties to manipulate in a 
coherent way several copies of their local states. Actu- 
ally, in the study of GKd with full generality, one should 
deal with joint (although local and Gaussian) operations 
by Alice and Bob. This defines a new type of Gaus- 
sian quantum privacy amplification protocols [5| different 
from entanglement distillability where Alice and Bob's 
goal is simply to factor Eve out 0, 0] . 

A related open question that deserves further investi- 
gation is whether secret bits can be extracted from PPT 
Gaussian states, i.e. strict bound entangled states (cf. 
0). At present, we know that our scheme does not work 
for any PPT state. The details of the proof are quite 
involved and will be given elsewhere. 

Quantum and classical distillation (QD and CD) pro- 
tocols are two techniques that allow to extract secret bits 
from entangled states. A schematic comparison between 
them is shown in figure |21 In finite systems, there are 
examples of non-distillable quantum states for which the 
CD branch is possible 7] . Moving to continuous variables 
systems and the Gaussian scenario, QD techniques are 
useless for key-agreement 0, 0] . Our analysis proves 
that CD is still useful for (i) all NPPT states under finite 
coherent attacks and (ii) sufficiently entangled NPPT 
states under general attacks. Thus, our results close the 
gap between NPPT entanglement and security for the 
case of finite-size coherent attacks. 
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